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What is claimed is: 

1 . A packet classifier comprising: 

a. a data structure for storing classification information, the structure contained 
in a memory and comprising a graph including a plurality of nodes connected by at least 

5 one edge for corresponding to at least one pattem, the graph configured such that 

movement between the nodes occurs upon at least one packet matching the at least one 
pattem; and 

b. a processor, including program means, for applying at least one packet to the 
data structure to classify the at least one packet. 

10 

2. The packet classifier of claim 1, wherein the graph is configured accommodate 
dynamically changing data. 

3. The packet classifier of claim 1, wherein matching includes at least a partial 
15 correspondence between the at least one packet and the at least one pattem. 

4. The packet classifier of claim 1, wherein each node includes at least one of an 
incoming edge or an outgoing edge. 

20 5. The packet classifier of claim 1, wherein the graph is configured to accommodate 
state based inspection data. 

6. The packet classifier of claim 1, wherein the graph is configured to accommodate 
packet aggregation data. 

25 

7. A method for searching a memory to locate information in a packet classification 
system, comprising the steps of: 

a. structuring the information so that it includes at least one graph including a 
plurality of nodes connected by at least one edge for corresponding to at least one 
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pattern, the at least one graph configured such that movement between the nodes occurs 
upon at least one packet matching the at least one pattern; and 

b. electronically searching the information in the memory to classify the at least 
one packet. 

5 

8. The method of claim 7, wherein the at least one graph is configured accommodate 
dynamically changing data. 

9. The method of claim 7, wherein the matching of the at least one packet to the at least 
10 one pattem includes at least a partial correspondence between the at least one packet and 

the at least one pattem. 

10. The method of claim 7, wherein each node includes at least one of an incoming edge 
or an outgoing edge. 

15 

1 1 . The method of claim 7, wherein the electronically searching the information in the 
memory to classify the at least one packet includes analyzing the at least one packet for a 
determination of its state. 

20 12. The method of claim 7, wherein the electronically searching the information in the 
memory to classify the at least one packet includes analyzing the at least one packet for a 
determination of at least one aggregation identifier from it. 

13. A computer memory storage device, configured to store packet classification data 
25 organized in graphs, each graph including a plurality of nodes connected by at least one 
edge for corresponding to at least one pattem, each graph configured such that 
movement between the nodes occurs upon at least one packet matching the at least one 
pattem. 
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14. The computer memory storage device of claim 13, wherein the each of the graphs is 
configured accommodate dynamically changing data. 

15. The computer memory storage device of claim 13, wherein the matching of the at 
5 least one packet to the at least one pattern includes at least a partial correspondence 

between the at least one packet and the at least one pattern. 

16. The computer memory storage device of claim of claim 13, wherein each node 
includes at least one of an incoming edge or an outgoing edge. 

10 

17. A method for classifying packets comprising: 

a. providing a graph including a plurality of nodes, connected by at least one 
edge, and at least one pattern corresponding to at least one edge, the at least one pattern 
including at least one state definition; 
15 b. applying at least one packet to the graph; and 

c. determining at least one state of the at least one packet, including analyzing at 
least one previously computed state coupled with the at least one state definition. 

18. The method of claim 17, additionally comprising: 

20 classifying the at least one packet based on the determined state for the at least 

one packet. 

19. The method of claim 17, wherein the at least one state definition includes a plurality 
of state definitions. 

25 

20. The method of claim 17, wherein the at least one state definition is embedded inside 
the at least one pattern. 

21. The method of claim 19, wherein the plurality of state definitions are embedded in 
30 the at least one pattern. 
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22. The method of claim 1 7, additionally comprising: storing data corresponding to the 
at least one determined state, such that the graph accommodates dynamically changing 
data. 

5 

23. A packet classifier comprising: 

a. a data structure for storing classification information, the structure contained 
in a memory and comprising a graph including a plurality of nodes, connected by at least 
one edge, and at least one pattem corresponding to at least one edge, the at least one 

10 pattem including at least one state definition; and 

b. a processor, including program means, for applying at least one packet to the 
data structure and determining at least one state of the at least one packet by analyzing at 
least one previously computed state coupled with the at least one state definition. 

15 24. The packet classifier of claim 23, wherein the processor additionally classifies the at 
least one packet based on the determined state for the at least one packet. 

25. The packet classifier of claim 23, wherein the at least one state definition includes a 
plurality of state definitions. 

20 

26. The packet classifier of claim 23, wherein the at least one state definition is 
embedded inside the at least one pattem. 

27. The packet classifier of claim 25, wherein the plurality of state definitions are 
25 embedded in the at least one pattem. 

28. The packet classifier of claim 23, additionally comprising: memory for storing data 
corresponding to the at least one determined state, such that the graph accommodates 
dynamically changing data. 

30 
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29. A computer memory storage device, configured to store packet classification data 
organized in graphs, each graph including a plurality of nodes, connected by at least one 
edge, and at least one pattern corresponding to at least one edge, the at least one pattern 
including at least one state definition. 

30. The computer memory storage device of claim 29, wherein the at least one state 
definition includes a plurality of state definitions. 

3 1 . The computer memory storage device of claim 29, wherein the at least one state 
definition is embedded inside the at least one pattern. 

32. The computer memory storage device of claim 30, wherein the plurality of state 
definitions are embedded the at least one pattern. 

33. The computer memory storage device of claim 29, additionally configured to store 
data corresponding to the at least one determined state, such that the graph 
accommodates dynamically changing data. 

34. A method of searching a memory to locate information in a system for classifying at 
least one packet comprising: 

a. structuring the information in a memory such that it includes at least one 
pattern, including state-based inspection data and aggregation data for at least one 
packet; and 

b. electronically searching the information in a memory to compare at least one 
packet to the at least one pattern. 

35. The method of claim 34, wherein the at least one pattern is included in a Direct 
Cyclic Graph. 
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36. The method of claim 35, additionally comprising: storing the Direct Cyclic Graph in 
the memory. 

37. The method of claim 36, wherein storing the Direct Cyclic Graph in the memory 

5 includes establishing a one-to-one correspondence between portions of the Direct Cyclic 
Graph and the information structured in the memory. 

38. The method of claim 37, wherein the portions of the Direct Cyclic Graph include 
nodes and edges. 

10 

39. The method of claim 38, additionally comprising: attaching the at least one pattern 
to at least one of: at least one node, or at least one edge. 

40. The method of claim 39, wherein the at least one pattern includes one pattern, the at 
1 5 least one node includes two nodes, and the at least one edge includes one edge. 

41. The method of claim 39, additionally comprising: traversing the Direct Cyclic 
Graph by moving through the at least one pattern, based on the attachment of the at least 
one pattern to the at least one node or at the at least one edge. 

20 

42. The method of claim 34, wherein the state-based inspection data includes at least one 
packet state identifier. 

43. The method of claim 34, wherein the aggregation data includes at least one of: flow 
25 identifier, session identifier or a packet identifier, for the at least one packet. 

44. A packet classifier comprising: 

a. a data structure for storing classification information, the structure contained 
in a memory and comprising at least one pattern, including state-based inspection data 
30 and aggregation data for at least one packet, and; 
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b. a processor including program means for searching the data structure to 
compare at least one packet to the at least one pattern. 

45. The packet classifier of claim 44, wherein the at least one pattern is included in a 
5 Direct Cyclic Graph, the Direct Cyclic Graph contained in the memory. 

46. The packet classifier of claim 45, wherein the Direct Cyclic Graph includes a one-to- 
one correspondence between portions of the Direct Cyclic Graph and the information in 
the memory. 

10 

47. The packet classifier of claim 46, wherein the Direct Cyclic Graph includes nodes 
and edges. 

48. The packet classifier of claim 44, wherein the state-based inspection data includes at 
1 5 least one packet state identifier. 

49. The packet classifier of claim 44, wherein the aggregation data includes at least one 
of: flow identifier, session identifier or a packet identifier, for the at least one packet. 

20 50. A packet classification system comprising: 

a network driver for receiving packets; 

a classification module in communication with the network driver for classifying 
packets received firom the network driver; 

an event module in communication with the classification module, the event 
25 module for receiving and processing classification data; 

a signaling module for determining at least one available engine for receiving 
classified packets, in communication with the event module; and 

a control module in communication with the signaling module and the classification 
module for maintaining and providing configuration information and controlling packet 
30 classification. 
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51. The packet classification system of claim 50, wherein the classification module 
includes an algorithm module for processing received packets against a direct cyclic 
graph and a kernel module for controlling packet flow from the network driver to the 
algorithm module. 

52. The packet classification system of claim 51, wherein the event module is 
configured for creating a communication to the kernel module for controlling packet 
flow therethrough. 

53. The packet classification system of claim 52, wherein the algorithm module includes 
at least a pair of queues in communication with the event module, for sending 
classification data to the event module. 
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